RE: [cti] i18n (RE: MVP Discussion) - An Updated Proposal

["Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>]

I'm not sure if I understand, are you proposing sending a second copy of the full object with the same ID and revision number with different content?

If so I am strongly against it as I the translation object gives us everything this does and more without risking breaking some major backend components of STIX.


Jeffrey Mates, Civ DC3/DCCI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computer Scientist
Defense Cyber Crime Institute
jeffrey.mates@dc3.mil
410-694-4335

-----Original Message-----
From: Mark Davidson [mailto:mdavidson@soltra.com] 
Sent: Friday, April 22, 2016 11:12 AM
To: Jordan, Bret
Cc: Wunder, John A.; Masuoka, Ryusuke; Mates, Jeffrey CIV DC3/DCCI; cti@lists.oasis-open.org
Subject: [Non-DoD Source] Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal

I think different languages of the same indicator are not revisions of each other and are just different representations of the same resource.

Therefore, I would think:

{
  ‘type’: ‘foo’,
  ‘id’: ‘1’,
  ‘lang’: ‘us’,
  ‘title’: ‘Hello’
}

{
  ‘type’: ‘foo’,
  ‘id’: ‘1’,
  ‘lang’: ’sp’,
  ‘title’: ‘Hola'
}

Is appropriate. Same as:

<foo id=“1” lang=“us">
   <title>Hello</title>
</foo>

They are all just different representations of the same thing.

Thank you.
-Mark

From: "Jordan, Bret" <bret.jordan@bluecoat.com>
Date: Friday, April 22, 2016 at 11:01 AM
To: Mark Davidson <mdavidson@soltra.com>
Cc: "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal


So STIX is supposed to be about how to transmit the data in a structured form.  So if you had in your database the original Indicator and a bunch of translations, and you got a request for the Indicator in say en-us, then you would have two options (based on your legal contracts and terms of use agreements).

1) Issue a new indicator under your identity space, and just include the en-us text.  As the example below

2) Republish the original ja version along with the en-us translation.  You may or may not decide to include the de translation.  

Thoughts????
 




 “indicators": [
 {
   "type": “indicator",
   "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4eAA",

   "revision": 1,
   "created_at": "2015-12-03T13:13Z",
   "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdDD",
   "lang”:"en-us",
   "title": "Dridex something or other 121",
   “description": "some sort of description"
 },


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 


	On Apr 22, 2016, at 08:50, Mark Davidson <mdavidson@soltra.com> wrote:

	 “indicators": [
	 {
	   "type": “indicator",
	   "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4e31",
	
	   "revision": 1,
	   "created_at": "2015-12-03T13:13Z",
	   "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdde",
	   "lang”:"ja",
	   "title": "Dridex キャンペーン - ボットネット 121",
	   “description": "「これは偽のメッセージであるが、それは怖いかもしれません」"
	 },

Attachment: smime.p7s
Description: S/MIME cryptographic signature